CVE-2026-86415

— UNSCORED

Published 2026-10-20 · Updated 2026-10-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.

All references

https://curl.se/docs/CVE-2026-86415.html
https://curl.se/docs/CVE-2026-86415.json
https://hackerone.com/reports/3993870

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.